Hi Michael,
In short, I took Alexey on his words on this matter since I didn't know
about the statements below...
However, I notice one _big_ if in the page you are referring to, which by
the way is quite old (dated circa 1996). Take a look at this page which is
linked from the document you showed:
http://cr.yp.to/syncookies/archive
According to this, we must turn off SACK and T/TCP for it to work:
"4. TCP options such as RFC1323, SACK and T/TCP options cannot be
used."
Nowhere does the documents explain how these problems can be solved (I
haven't read the whole document yet, so I may burst out prematurely... but
I wanted to respond to your questions:)).
I will look closer on this and see if there's any more up to date
information on the matter, what happens with SACK etc if SYN cookies are
turned on (may take a while, I will need to check the source code as
usual I expect=)).
On Wed, 23 Oct 2002, Michael T. Babcock wrote:
> Oskar Andreasson wrote:
>
> >>>may be of interest to some people on the netdev mailinglist as
well.
> >>>Just to inform people who may be interested, the ipsysctl
tutorial has
> >>>been released in a new version at
http://ipsysctl-tutorial.frozentux.net.
> >>>
> >>>
> I'd like to ask for some clarifications, if not quoting, in the tutorial
> on page x321.html (not sure of section numbers) re: syn cookies.
>
> Dan Bernstein (everyone's favorite mathematician :-) ) makes it very
> clear on http://cr.yp.to/syncookies.html that your warnings are
> primarily FUD. For the sake of quoting:
>
> A few people (notably Alexey Kuznetsov, Wichert Akkerman, and Perry
> Metzger) have been spreading misinformation about SYN cookies. Here are
> some of their bogus claims:
>
> * SYN cookies ``present serious violation of TCP protocol.''
> Reality: SYN cookies are fully compliant with the TCP protocol.
> Every packet sent by a SYN-cookie server is something that could
> also have been sent by a non-SYN-cookie server.
> * SYN cookies ``do not allow to use TCP extensions'' such as large
> windows. Reality: SYN cookies don't hurt TCP extensions. A
> connection saved by SYN cookies can't use large windows; but the
> same is true without SYN cookies, because the connection would
> have been destroyed.
> * SYN cookies cause ``massive hanging connections.'' Reality: With
> or without SYN cookies, connections occasionally hang because a
> computer or network is overloaded. Applications deal with this by
> simply dropping idle connections.
> * SYN cookies cause ``serious degradation of service.'' Reality: SYN
> cookies /improve/ service. They do take a small amount of CPU time
> to compute, but that CPU time has to be spent anyway for
> hard-to-predict sequence numbers; see RFC 1948.
> * SYN cookies cause ``magic resets.'' Reality: SYN cookies never
> cause resets.
>
> These people also have the annoying habit of crediting their bogus
> claims to other people, such as me. I don't know whether to attribute
> this to malice or stupidity; either way, I would like the record to be
> set straight.
>
> I invited Kuznetsov to either retract or defend his claims. He refused
> to do so. I'm sure he's aware by now that his claims are false, and that
> any attempted defense will be promptly ripped to shreds; but he's still
> not admitting his errors. It's unfortunate that he doesn't have more
> respect for the truth.
>
> I also invited Akkerman to either retract or defend his claims. He did
> not respond.
>
>
--
----
Oskar Andreasson
http://www.frozentux.net
http://iptables-tutorial.frozentux.net
http://ipsysctl-tutorial.frozentux.net
mailto:blueflux@koffein.net